⬢ DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2475

Wrong bitmask includes task-attribute bits in IU length causing ATIO queue consumer to skip 128-960 entries on any non-SIMPLE FCP_CMND (remote DoS)

Summary

In isp_target_notify() 24XX long-IU length computed as at7iop->at_ta_len & 0xfffff. Field at_ta_len is uint16_t packing [task_attribute:4 bits 12-15][IU_length:12 bits 0-11]. Mask 0xfffff (20 bits) is no-op on 16-bit value FAILS to strip task-attribute nibble. Any incoming FCP_CMND with non-zero task attribute (ORDERED=2 HEAD=1 ACA=4 etc standard freely-set initiator attributes) misclassified as multi-entry long IU consumer-output pointer advanced 128-960 positions around 1024-entry ATIO ring silently dropping that many pending ATIO/NOTIFY entries. For ORDERED command at_ta_len=(2<<12)|0x20=0x2020 len becomes 8224 instead of 32. test 8224>56 true loop runs ceil(8168/64)=128 times each *optrp=ISP_NXT_QENTRY skipping entries. Attacker: any FC initiator on fabric no authentication sends single SCSI command with non-SIMPLE task attribute. Dropped entries are other initiators commands and task-management NOTIFYs breaking exchange cleanup.

Discussion (0)

No comments yet.

PoC verification

Evidence pack

findings/poc/DF-2475 · 6 files
FileTypeDescriptionSize
VERDICT.md verdict Source trace confirming DF-2475 bug is real but HW-gated 1.4 KB ↓ raw
fix.diff suggested-fix Change at_ta_len mask from 0xfffff to 0xfff to strip task-attribute nibble 485 B view raw
env.txt environment Guest gate proof: kldstat, pciconf, camcontrol (no target HBA) 1.1 KB view raw
build.sh build-script No buildable PoC (HW-gated) 384 B view raw
run.sh run-script Gate verification commands 411 B view raw
README.md readme Overview of HW-gated finding 791 B ↓ raw
README.md readme Overview of HW-gated finding
↓ download raw

HW-gated SCSI/FC HBA driver finding

This finding targets a SCSI/FC/SATA HBA driver that is not present in this QEMU/KVM guest (only PIIX3 IDE + virtio). The driver cannot attach and the cited code path is unreachable at runtime.

Reproduction status: NOT REPRODUCED (HW-gated)

  • The source bug is confirmed real by line-by-line source trace (see VERDICT.md).
  • It cannot be triggered because the HBA hardware/driver does not exist on this guest.
  • A defense-in-depth fix.diff has been authored and validated with git apply --check.

Evidence

  • VERDICT.md — full source trace and analysis
  • env.txt — guest environment (kldstat, pciconf, camcontrol gate proof)
  • fix.diff — git-apply-able defense-in-depth fix
  • manifest.json — machine-readable catalog
VERDICT.md verdict Source trace confirming DF-2475 bug is real but HW-gated
↓ download raw

DF-2475 — Wrong bitmask includes task-attribute bits in IU length

Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

Hardware gate

No QLogic ISP HBA in guest: kldstat shows only kernel/ehci/xhci; pciconf -l shows no QLogic device. ISP target mode is never active.

Source trace (confirmed real bug)

File: sys/dev/disk/isp/isp_target.c:174

len = at7iop->at_ta_len & 0xfffff;   // line 174

at_ta_len is declared uint16_t (ispmbox.h:2135), packing [task_attribute:4 bits 12-15][IU_length:12 bits 0-11]. The mask 0xfffff is 20 bits wide, which is a no-op on a 16-bit value — it fails to strip the task-attribute nibble (bits 12-15). Any FCP_CMND with a non-zero task attribute (ORDERED=2, HEAD_OF_QUEUE=1, ACA=4) is misclassified: e.g., for ORDERED, at_ta_len = (2<<12)|0x20 = 0x2020, so len becomes 8224 instead of 32. The test len > (QENTRY_LEN - 8) is true, and the loop at 178-181 advances *optrp by 128+ positions around the 1024-entry ATIO ring, silently dropping that many pending ATIO/NOTIFY entries.

Fix

Changed mask from 0xfffff to 0xfff (12-bit IU length, stripping the 4-bit task-attribute field). See fix.diff.

Impact (on HW that has the HBA)

High — remote DoS: any FC initiator on the fabric sends one SCSI command with a non-SIMPLE task attribute and the ATIO ring consumer silently drops 128-960 entries, breaking exchange cleanup for other initiators.

Fix verification

not_testable
baseline no→ patch + rebuild →patched clean

not_testable: target driver cannot attach (no target HBA). fix.diff validated with git apply --check (EXIT=0); fix is correct by source trace.

git apply --check findings/poc/DF-2475/fix.diff => EXIT=0. No runtime test possible (no target HBA).
↓ fix.diffDragonFly 6.5-DEVELOPMENT #0 (unpatched with-src baseline — target driver not loadable on this guest)

Confirmed kernel references

Detail

Exploit chain

none — valid hard blocker (driver code path dead at runtime on this guest: no target HBA). No unprivileged->root path.

Evidence (decisive lines)

kldstat -> kernel/ehci/xhci only (no target driver); pciconf -l -> PIIX3 IDE + virtio only (no target HBA); camcontrol devlist -> only <QEMU QEMU DVD-ROM>. Source confirmed at cited lines.

PoC changes

Created findings/poc/DF-2475/{VERDICT.md,fix.diff,manifest.json,env.txt,build.sh,run.sh,README.md}. No PoC source (HW-gated).

Verified recommended fix

Defense-in-depth fix.diff closes the cited path (see findings/poc/DF-2475/fix.diff; git apply --check OK).

Verdict

NOT REPRODUCED (HW-gated). The bug is REAL in source (traced line-by-line): isp_target wrong bitmask 0xfffff vs 0xfff on 16-bit at_ta_len (task-attr nibble not stripped; needs ISP target mode). Gate confirmed: kldstat (only kernel+ehci+xhci; no isp/mpt/sili/trm/sbp module loaded), pciconf -l (no QLogic ISP/LSI MPT/SiliconImage/Tekram/FireWire HBA — only PIIX3 IDE atapci0 + virtio), camcontrol devlist (only QEMU DVD-ROM). The target driver cannot attach so the cited code path is dead at runtime on this guest.